                                   :volume_size 35
                                   },
                     :snapshot_options { :automated_snapshot_start_hour 23}})
+
+     (vpc-resource "aws_iam_role" "logstash" {:name "logstash"
+                                              :assume_role_policy (json/generate-string {
+                                                                                         "Version" "2012-10-17",
+                                                                                         "Statement" [
+                                                                                                      {
+                                                                                                       "Action" "sts:AssumeRole",
+                                                                                                       "Principal" {
+                                                                                                                    "Service" "ec2.amazonaws.com"
+                                                                                                                    },
+                                                                                                       "Effect" "Allow",
+                                                                                                       "Sid" ""}]})})
+
+     (vpc-resource "aws_iam_role_policy" "logstash"
+                   {"name" "logstash"
+                    "role"  (vpc-id-of "aws_iam_role" "logstash")
+                    "policy" (json/generate-string {
+                                                    "Version" "2012-10-17"
+                                                    "Statement" [{
+                                                                  "Resource" es-arn-*,
+                                                                  "Action" ["es:*"],
+                                                                  "Effect" "Allow"
+                                                                  }
+                                                                 {
+                                                                  "Resource" es-arn,
+                                                                  "Action" ["es:*"],
+                                                                  "Effect" "Allow"
+                                                                  }
+                                                                 ]})})
+
+     (vpc-resource "aws_iam_instance_profile" "logstash" {
+                                                          :name "logstash"
+                                                          :roles  [(vpc-output-of "aws_iam_role" "logstash" "name")]
+                                                          })
+
      (add-key-name-to-instances
       key-name
       (in-vpc (id-of "aws_vpc" vpc-name)

  (:require [terraboot.core :refer :all]
            [terraboot.utils :refer :all]
            [terraboot.cloud-config :refer [cloud-config]]
            [cheshire.core :as json]))

(def logstash-user-data (cloud-config {:package_update true
                                       :bootcmd ["echo oracle-java8-installer shared/accepted-oracle-license-v1-1 select true | /usr/bin/debconf-set-selections"
                                                 "wget -qO - https://packages.elastic.co/GPG-KEY-elasticsearch | apt-key add -" ]
                                       :apt_sources [{:source "ppa:webupd8team/java"}
                                                     {:source "deb http://packages.elastic.co/logstash/2.3/debian stable main"
                                                      :key (snippet "system-files/elasticsearch-apt.pem")}]
                                       :packages ["oracle-java8-installer"
                                                  "oracle-java8-set-default"
                                                  "logstash"]
                                       :runcmd ["update-rc.d logstash defaults"]
                                       :write_files [{:path "/etc/logstash/conf.d/out-es.conf"
                                                      :permissions "644"
                                                      :content (snippet "vpc-logstash/out-es.conf")}
                                                     {:path "/etc/logstash/conf.d/in-beats.conf"
                                                      :permissions "644"
                                                      :content (snippet "vpc-logstash/in-beats.conf")}
                                                     {:path "/etc/logstash/conf.d/in-gelf.conf"
                                                      :permissions "644"
                                                      :content (snippet "vpc-logstash/in-gelf.conf")}
                                                     {:path "/opt/logstash/patterns/basic-batterns"
                                                      :permissions "644"
                                                      :content (snippet "vpc-logstash/basic-patterns")}]}))

(defn elasticsearch-policy
  []

        vpc-id-of (id-of-fn vpc-unique)
        vpc-output-of (output-of-fn vpc-unique)
        vpc-security-group (partial scoped-security-group vpc-unique)
        elb-listener (account-elb-listener account-number)
        es-arn (str "arn:aws:es:" region ":" account-number ":domain/" vpc-name "-elasticsearch-5")
        es-arn-* (str es-arn "/*")]

    (merge-in
     (template-file (vpc-unique "elasticsearch-policy")
                    (elasticsearch-policy)
                    {:es-arn es-arn-*
                     :allowed-ips  (vpc-output-of "aws_eip" "vpn" "public_ip")})

     (vpc-resource "aws_elasticsearch_domain" (str (vpc-unique name) "-5")
                   {:domain_name (str (vpc-unique name) "-5")
                    :elasticsearch_version "5.1"
                    :advanced_options { "rest.action.multi.allow_explicit_index" "true"}
                    :access_policies (rendered-template-file (vpc-unique "elasticsearch-policy"))
                    :cluster_config {:instance_count 2,
                                     :instance_type "t2.small.elasticsearch"}
                    :ebs_options {:ebs_enabled true,
